xmrig | 9d3eca512f54ed0ebae6d5fe72500e9aeff40f4df269a8287e55145155d05ff5

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 15:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d39514b639aebbad6285b51f86ff9392.exe
Size

784KB
MD5

d39514b639aebbad6285b51f86ff9392
SHA1

b96d9b1342d5f2f45c193e2e8b5b160f6276d10b
SHA256

9d3eca512f54ed0ebae6d5fe72500e9aeff40f4df269a8287e55145155d05ff5
SHA512

9c3bcf42468ca99061376125de67b4f57e2c68230d88dde777492fdbf1a961351dfd482f8dd6ab07b3d75c87f209799c550018dfedf670d2b80646e618a10c19
SSDEEP

12288:gS49QwjtNNJFFCG3C1Yq2oNVLH6/WPI9a0v21YL/cv4AlKR5vQcOs/fABna:glDNbcYqp3LLPI97v7LEv4wjs/fABn

Score

10^/10

xmrig miner upx

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 6 IoCs

miner

resource	yara_rule
behavioral2/memory/5056-2-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/5056-12-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/1556-15-0x0000000000400000-0x0000000000593000-memory.dmp	xmrig
behavioral2/memory/1556-21-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig
behavioral2/memory/1556-20-0x00000000053E0000-0x0000000005573000-memory.dmp	xmrig
behavioral2/memory/1556-30-0x0000000000400000-0x0000000000587000-memory.dmp	xmrig

Deletes itself 1 IoCs

pid	Process
1556	d39514b639aebbad6285b51f86ff9392.exe

Executes dropped EXE 1 IoCs

pid	Process
1556	d39514b639aebbad6285b51f86ff9392.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5056-0-0x0000000000400000-0x0000000000712000-memory.dmp	upx
behavioral2/files/0x00070000000231f9-11.dat	upx
behavioral2/memory/1556-13-0x0000000000400000-0x0000000000712000-memory.dmp	upx

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5056	d39514b639aebbad6285b51f86ff9392.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
5056	d39514b639aebbad6285b51f86ff9392.exe
1556	d39514b639aebbad6285b51f86ff9392.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5056 wrote to memory of 1556	5056	d39514b639aebbad6285b51f86ff9392.exe	58
PID 5056 wrote to memory of 1556	5056	d39514b639aebbad6285b51f86ff9392.exe	58
PID 5056 wrote to memory of 1556	5056	d39514b639aebbad6285b51f86ff9392.exe	58

C:\Users\Admin\AppData\Local\Temp\d39514b639aebbad6285b51f86ff9392.exe
"C:\Users\Admin\AppData\Local\Temp\d39514b639aebbad6285b51f86ff9392.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:5056
- C:\Users\Admin\AppData\Local\Temp\d39514b639aebbad6285b51f86ff9392.exe
  C:\Users\Admin\AppData\Local\Temp\d39514b639aebbad6285b51f86ff9392.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1556

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\d39514b639aebbad6285b51f86ff9392.exe

Filesize
338KB

MD5
6497ab212b1779eea8238569b8547b45

SHA1
a15a4e6833b34c1fedbd952fd26fcc36da0ed80b

SHA256
20e591777effd9d09bfd2223782708356024e792af90cac8ca29429b61761f5e

SHA512
37fb823113f798c1202bcdb7acb02cfe73259b6f639ffeaf6669663ac0f6662e2d869e606d28ac16004974d2f83c3b9e84e7ab25df78c1aa84bc39d52cf23ff1

Download Submit
memory/1556-13-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/1556-14-0x00000000019F0000-0x0000000001AB4000-memory.dmp

Filesize
784KB

Download
memory/1556-15-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/1556-21-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/1556-20-0x00000000053E0000-0x0000000005573000-memory.dmp

Filesize
1.6MB

Download
memory/1556-30-0x0000000000400000-0x0000000000587000-memory.dmp

Filesize
1.5MB

Download
memory/5056-0-0x0000000000400000-0x0000000000712000-memory.dmp

Filesize
3.1MB

Download
memory/5056-1-0x0000000001A00000-0x0000000001AC4000-memory.dmp

Filesize
784KB

Download
memory/5056-2-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/5056-12-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download